msgraph subscrition to 1:1 or group chat messages from Teams?

Question

I want to create an MS graph subscription ("change tracking") to receive notifications when a user messages a Teams bot installed in their personal context. The following registration is accepted by the API (and can later be retireved with GET https://graph.microsoft.com/beta/subscriptions). Note that this registration has be posted to the beta version of the API:

curl -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' --data-binary '{                                             
       "changeType": "created,updated",
       "notificationUrl": "EventHub:<kv-secret-uri>?tenantId=<tenant-uuid>",
       "lifecycleNotificationUrl": "EventHub:<kv-secret-uri>?tenantId=<tenant-uuid>",
       "resource": "appCatalogs/teamsApps/<installed-app-id>/installedToChats/getAllMessages",
       "expirationDateTime":"2023-10-19T12:00:00.000000Z",
       "clientState": "secretClientValue",
    }' https://graph.microsoft.com/beta/subscriptions

However, when sending 1:1 messages to the bot, no events are posted to the EventHub. Am I not supposed to receive notifications for 1:1 messages this way?

Alternatively, I am able to subscribe to chats/<chat-id>/messages and receive updates this way, but how do I find the <chat-id> of all users that installed the app? One might have imagined that GET https://graph.microsoft.com/beta/appCatalogs/teamsApps/<installed-app-id>/installedToChats would give this information, but that endpoint seems not to be implemented, nor does subscription to appCatalogs/teamsApps/<installed-app-id>/installedToChats yield any change events when a user adds the bot to their personal context.

Relevant parts of my manifest.json. The bot is installed to a specific organization.

"bots": [
  {
    "botId": "<external-app-id>",
    "scopes": ["team","personal"],
    "supportsFiles": false,
    "isNotificationOnly": false,
    "commandLists": []
  }
],
...
"authorization": {
  "permissions": {
    "resourceSpecific": [
      {
        "type": "Application",
        "name": "ChannelMessage.Read.Group"
      },
      {
        "type": "Application",
        "name": "ChatMessage.Read.Chat"
      },
      {
        "type": "Application",
        "name": "ChatMessage.Send.Chat"
      }
    ]
  }
}

The service principal has the following API permissions: AppCatalog.Read.All, Chat.ReadWrite.WhereInstalled, Chat.Read.All, ChatMessage.Read.All. (The latter two are not desirable, but are added in order to minimize the risk of permissions errors.)

Can anyone give me a hint as to how to use the MS graph API to be evented on 1:1 chat messages from users?

Answer 1

you can retrieve the chatId with the following request but it requires the broader Chat.Read.All permission:

GET https://graph.microsoft.com/v1.0/users/{user-id}/chats?$filter=installedApps/any(a:a/teamsApp/id eq '{teamsAppId}')